Instructor: Permissions audits. 2 2
In this lesson, I'm going to show you how we perform 3 3
account and permission audits, 4 4
and we're going to jump into the lab environment to do this. 5 5
As I do this, we're going to be using 6 6
one of my Windows Domain Controllers that I built in my lab. 7 7
The first thing we're going to do 8 8
is we're going to open up the server manager. 9 9
Once we're inside the server manager, 10 10
we're going to go into the active directory, 11 11
users and computers. 12 12
From here, we're going to expand 13 13
the corp.515support.com domain and select the audit 14 14
OU container. 15 15
Now in this example, 16 16
what I'm going to do is pretend 17 17
that my company is being audited. 18 18
So I'm going to have several people 19 19
who are going to come in to perform an audit. 20 20
These are going to be people like Anthony Stevens, 21 21
Catherine Ruiz, Douglas Price, 22 22
Irene Taylor, and Luke Packard. 23 23
All of them should have received a user account 24 24
and then placed in the audit OU container. 25 25
Now when I look here, 26 26
I only see that four of those people are there. 27 27
I'm missing Anthony Stevens. 28 28
So we're going to want to go ahead 29 29
and find Anthony Stevens and put him in this OU 30 30
and then verify he has the right permissions. 31 31
To do this, we're going to right click 32 32
on corp.515support.com and select find. 33 33
From here we can type 34 34
in the user's name, Anthony Stevens, and click find now. 35 35
Once we find him in the search results, 36 36
we can right click that account, select move, 37 37
and select the appropriate container. 38 38
In this case, AuditOU and click okay. 39 39
At this point, we can close the find dialogue box. 40 40
Now we don't see his name in this pane yet, 41 41
and that's because we haven't refreshed it. 42 42
So let's right click in the pane and select refresh. 43 43
Now we see Anthony Stevens. 44 44
Let's go ahead and verify his permissions are correct. 45 45
We'll right click on Anthony Stevens 46 46
and click on properties. 47 47
Once we're in properties, 48 48
we're going to select the account tab. 49 49
Here, under account options, we want to verify 50 50
that the user must change password at next logon is selected 51 51
because we gave him a temporary password 52 52
of password for him to log in the first time. 53 53
And then we want to select the password never expires option 54 54
and ensure it's unchecked. 55 55
That way he has to change his passwords 56 56
in accordance with our policies. 57 57
Now let's go ahead and take a look at our logon hours. 58 58
Go ahead and click on logon hours. 59 59
And from here we can see that this user is not 60 60
able to access his accounts on the weekends. 61 61
Now this table is going to show us a 24-hour day 62 62
and any white cells are deny access 63 63
and any blue cells means to allow access. 64 64
Because he's going to be working Monday through Friday, 65 65
he should only be able to use it 66 66
during those working hours and not during the weekends. 67 67
So at this point, we're going to go ahead 68 68
and click cancel and then we're going to click 69 69
log on to button. 70 70
In the logon workstation's dialogue box, we can verify 71 71
that he's only able to log on to audit-alpha computer. 72 72
This means that this auditor 73 73
has one machine he's assigned to, 74 74
and this can help us verify 75 75
since we're giving auditors special permissions 76 76
that they can't do it on any other systems, 77 77
or if their account is compromised, 78 78
they can minimize the damage. 79 79
From here, let's take a look at the member of tab 80 80
to see what groups Anthony Stevens belongs to. 81 81
Now, as we look at this, 82 82
is there anything that looks abnormal? 83 83
Well, yeah, it shows that he's a domain admin. 84 84
That is a big security risk. 85 85
So we want to go into the domain admin, 86 86
click on that in the member of list, and then remove it. 87 87
At this point, we'll confirm it by saying yes, 88 88
and then we can click the add button 89 89
and select the right group for him, 90 90
which in our case is sec-glo-audit, 91 91
which is going to be for our auditors who are 92 92
performing their audits here this week. 93 93
Now at this point, Anthony's account is all good. 94 94
We've looked through the permissions, 95 95
we've checked the logon times, 96 96
and we made sure he is a member of the right groups. 97 97
And now we would go through and do the same thing 98 98
for Catherine, Douglas, Irene, and Luke. 99 99
Once we're done looking through all of their accounts, 100 100
we can then move on to our next section. 101 101
And our next thing we're going to look 102 102
at is any other IAM issues we may have. 103 103
One of the big ones is making sure that we go 104 104
through our accounts and make sure that any accounts 105 105
on the domain are cleaned up according to our policy. 106 106
For example, we might want to go into the user's container 107 107
and then select view filter options. 108 108
From here, we can select the following types of objects 109 109
radio button, and check users and hit okay. 110 110
Now we can see all the users on this system. 111 111
For example, here in the users, you can see two 112 112
accounts that are actually not supposed to be there. 113 113
For example, you see the guest account, 114 114
you should right click on this 115 115
and disable that because it could be used by attackers. 116 116
The other one I like to disable is administrator. 117 117
Instead of using the administrator account 118 118
using the word administrator, 119 119
you should select something that isn't 120 120
as easily guessed by an attacker. 121 121
Since the administrator account is a default built-in 122 122
account on all window systems, 123 123
attackers know to look for it. 124 124
So instead, you should create another administrator 125 125
account that's not named administrator 126 126
and then disable the administrator account.